diff options
| author | Tristan Matthews <tmatth@videolan.org> | 2019-11-04 21:40:50 +0300 |
|---|---|---|
| committer | Tristan Matthews <tmatth@videolan.org> | 2019-11-04 22:01:31 +0300 |
| commit | 8d6eea3d7882c3dccfd53a5798baac92d729aad5 (patch) | |
| tree | 478054220b83bc8211ff179405db6b53c3934f1c | |
| parent | d5f30cba3d969e21c0303494045331b21183fc06 (diff) | |
speexdec_fuzzer: avoid integer overflow
Fixes ubsan error in fuzzer:
"runtime error: signed integer overflow: 2147483616 + 160 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/speex
| -rw-r--r-- | contrib/oss-fuzz/speexdec_fuzzer.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/contrib/oss-fuzz/speexdec_fuzzer.cc b/contrib/oss-fuzz/speexdec_fuzzer.cc index 8ec9051..029b69e 100644 --- a/contrib/oss-fuzz/speexdec_fuzzer.cc +++ b/contrib/oss-fuzz/speexdec_fuzzer.cc @@ -311,6 +311,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *fuzz_data, size_t fuzz_size if (channels==2) speex_decode_stereo_func(output, frame_size, &stereo); + if (INT_MAX - lookahead > skip_samples) { int new_frame_size = frame_size; if (packet_no == 1 && j==0 && skip_samples > 0) |